| Titolo | Kamailio 6.0.7+ Out-of-Bounds Read |
|---|
| Descrizione | An out-of-bounds read vulnerability exists in multiple IMS Diameter modules in Kamailio in 6.0.7+.
Several Diameter answer AVP handlers pass attacker-controlled AVP data to get_4bytes() without first verifying that the AVP value contains at least four bytes. The get_4bytes() macro unconditionally accesses data.s[0] through data.s[3]. Consequently, a malformed Unsigned32 AVP with a value length of one to three bytes causes the code to read beyond the declared AVP value.
The issue affects Diameter answer processing in multiple IMS modules, including ims_auth, ims_charging, ims_icscf, ims_ocs, ims_qos, ims_qos_npn, and ims_registrar_scscf. Affected messages include Cx UAA/LIA/MAA/SAA responses, Ro/Gy CCA responses, and Rx AAA responses. A malicious, compromised, or misconfigured Diameter peer such as an HSS, OCS, or PCRF can trigger the issue by returning a malformed short Unsigned32 AVP.
Affected AVPs include Experimental-Result-Code, Result-Code, Mandatory-Capability, Optional-Capability, CC-Request-Type, CC-Request-Number, CC-Time, Validity-Time, Time-Quota-Threshold, and Final-Unit-Action.
Because Diameter AVP values are normally followed by alignment padding and received messages are stored in a shared-memory pool, the out-of-bounds read will frequently consume adjacent padding or message data instead of immediately causing a crash. This can result in an incorrect integer value being used by the IMS transaction logic. Depending on message placement and allocator behavior, the operation can also read beyond the end of the message allocation. A standalone AddressSanitizer reproducer using the affected check-and-read pattern confirms the heap-buffer-overflow read.
Successful exploitation requires the ability to send Diameter answer messages to a Kamailio IMS deployment. In typical deployments this position is limited to configured Diameter peers or an attacker who has compromised or can impersonate such a peer. No reliable remote crash, information disclosure, or code execution has been demonstrated.
The vendor was notified through Kamailio GitHub issue #4816. The issue was acknowledged and fixed by validating AVP lengths before get_4bytes() calls. The upstream fix was merged on 2026-07-16 in pull request #4823, merge commit abb5d60af6eefbd367bf6588c5589566b090e272.
References:
https://github.com/kamailio/kamailio/issues/4816
https://github.com/kamailio/kamailio/pull/4823
https://github.com/kamailio/kamailio/commit/abb5d60af6eefbd367bf6588c5589566b090e272 |
|---|
| Fonte | ⚠️ https://github.com/kamailio/kamailio/issues/4816 |
|---|
| Utente | Hancl (UID 99862) |
|---|
| Sottomissione | 16/07/2026 13:52 (1 mese fa) |
|---|
| Moderazione | 30/08/2026 09:34 (1 month later) |
|---|
| Stato | Accettato |
|---|
| Voce VulDB | 397109 [Kamailio fino a 5.5.0/6.0.7 AVP cxdx_avp.c get_4bytes rivelazione di informazioni] |
|---|
| Punti | 20 |
|---|